HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Western Orthopaedics

bd_7cfe93f602b1b9ef · schema v1 · pii pii-v2

Severity

Medium

Discovered

Oct 2, 2025

Filed

May 1, 2026

To disclose

30 weeks

Affected

100state residents only

Linked

6 records

Confidence

69%

Full breach record for Western Orthopaedics →

Western Orthopaedics, P.C. notified Montana residents of a data breach occurring between September 17-25, 2025, discovered on October 2, 2025. Unauthorized access resulted in the exposure of PHI, SSNs, DOBs, and financial account numbers. The company engaged cybersecurity experts, contained the network, and offered complimentary credit monitoring via Epiq. No identity theft has been indicated to date.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d30 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 15 days

discovery → filing · 30 weeks / 211 days

Sep 17, 2025

Begins

Oct 2, 2025

Discovered

May 1, 2026

Filed

vs. sector median

+21 wks slower

This filing is one of 6 records about the same incident.View merged incident

A leak claim by pear about this victim was first seen 209 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepearbd_1b5a6c58e8d0d6a02025-09-30 · +213dVerified

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_9d4742af409277552026-05-01Verified
Massachusetts State AGbd_dd272a44847c47002026-05-01Verified
Nebraska State AGbd_f99702c4eaa434f12026-05-01Verified
Texas State AGbd_207ddfb598a318082026-05-05 · +4dVerified

Name: Western Orthopaedics
norm: western orthopaedics
Domain: western-ortho.com

Name: Western Orthopaedics
norm: western orthopaedics
Domain: western-ortho.com
Industry: Healthcarellm

Discovered: Oct 2, 2025
Breach occurred: Sep 17, 2025 – Sep 25, 2025
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 100state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took immediate steps to investigate, contain, and remediate the incident with the assistance of our contracted cybersecurity team and external cybersecurity experts
Conducted an analysis to determine whether personal information, including protected health information, was present in the affected data
Arranged for you to enroll in complimentary credit monitoring and identity protection services for <<CM Duration>> months, at no cost to you, through Epiq
Changes made: Arranged for you to enroll in complimentary credit monitoring and identity protection services for <<CM Duration>> months, at no cost to you, through Epiq
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRMay 1 · first

Massachusetts State AGMay 1 · first

Nebraska State AGMay 1 · first

Montana State AGMay 1 · first · this page

Texas State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/09/Consumer-notification-letter-20.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 1, 2026
Raw hash: d011c99b6f3dcfa2f10c4c921ac2b477cca6d672ec96f38b71114fd0724992b2

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityWestern Orthopaedics

Victim entityWestern Orthopaedics

Incidentdiscovered Oct 2, 2025

Stated responseTook immediate steps to investigate, contain, and remediate the incident with the assistance of our contracted cybersecurity team and external cybersecurity experts

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov